66098 matches found
EUVD-2026-19726
ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For...
CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...
CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...
CVE-2026-35571 Emissary has Stored XSS via Navigation Template Link Injection
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...
CVE-2026-35571
CVE-2026-35571 affects Emissary prior to 8.39.0. Mustache navigation templates interpolated config-controlled link values directly into href attributes without URL scheme validation, allowing an administrator with navItems access to inject javascript: URIs and trigger stored XSS against other aut...
CVE-2026-3466
creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:30+00:00| published-proof-of-concept| Telegram/OQovZCNyncHtmKsEQoVAn9WglYI3Qk-HPEu8DU-i8r2-BaQ 2026-04-07 15:38:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw4crqhwx2n...
CVE-2026-28808
creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:06+00:00| published-proof-of-concept| Telegram/QBh1FHyWJUCKYAyST3Bw6jIrLbUdJEHanO8DcWQylla0 2026-04-07 15:48:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw4uon3zm24...
CVE-2025-39666
creationtimestamp| type| source ---|---|--- 2026-04-07 15:20:46+00:00| seen| Telegram/ubthoF1g8rbiNT2f93TzwsoAmJLY2ZrVE2ygc3thq3uaBv8 2026-04-07 15:28:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw3s5p3cv2i...
CVE-2026-4401
creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4401 2026-04-08 00:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwytkwmbm2z 2026-04-20 15:37:06+00:00| seen|...
CVE-2026-2263
creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:04+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2263 2026-04-08 00:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwyqus2xm2o 2026-04-20 13:37:06+00:00| seen|...
CVE-2026-35516 LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services AWS IMDSv1, cloud metadata, internal APIs by creating a link with a publ...
CERTFR-2026-ACT-015
creationtimestamp| type| source ---|---|--- 2026-04-07 14:41:37+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mivz5ulz6q2n 2026-04-12 02:57:19+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3mjbe4yzibh2t...
CVE-2026-20884
creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:34+00:00| seen| https://infosec.place/objects/42dbf6e7-c4bd-4f56-9d41-4a7d96bb33dd 2026-04-07 16:07:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw5wywaau2r 2026-04-07 17:28:45+00:00|...
CVE-2026-25339
creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mivyjf3rl22j...
CVE-2026-3466
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking a...
CVE-2026-3466 Cross-site scripting in dashlet title
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking a...
CVE-2026-3466
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 EOL, Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 beta before 2.5.0b3 allows an attacker with dashboard creation privileges to perform stored cross-site scripting XSS attacks by tricking...
CVE-2020-35881
creationtimestamp| type| source ---|---|--- 2026-04-07 11:43:13+00:00| seen| https://gist.github.com/soul2zimate/a5296bc917881b1c43c396b5caf75393...